A recurring theme in recent regulatory developments is the SRA’s increasing reliance on thematic reviews, warning notices, position papers, and other informal guidance to set expectations for law firms. While these documents are intended to clarify existing rules, they often feel like new regulations in disguise, raising fundamental questions about fairness, transparency, and the future of legal regulation.
Thematic reviews as a tool for regulating
Thematic reviews are becoming the SRA’s go-to tool for shaping firm behaviour. While potentially useful for understanding and highlighting behaviour in law firms, they also blur the lines between guidance and enforceable rules. Invariably, these reports make certain judgments about what “good” and “bad” looks like. This has the effect of reading between the lines of existing, hitherto “flexible” rules.
The recent AML training thematic review, for instance, makes it clear that firms must “put in place a comprehensive AML training programme which is relevant to the legal sector and specific to their firm”. The SRA says that evidence of training must include keeping records of “training documentation (presentations, notes, hand-outs, copies of online content etc)…attendance records…dates of training…the results of any assessments carried out…”. They also suggest that traditional AML training courses and e-Learning will not cut it anymore, unless they are made bespoke to the firm.
These “requirements” are all the SRA’s interpretation of the Money Laundering Regulations. As the supervising authority, the SRA has the power to inflict penalties on firms that they deem non-compliant, so firms simply have no option but to follow the SRA’s interpretation.
Official guidance notes come with the warning that “we will have regard to [this guidance] when exercising our regulatory functions”. So although not a mandatory rule, it would be very brave to ignore. It therefore has the effect of driving certain behaviour in those being regulated.
This raises an uncomfortable truth: we are moving towards regulation by the back door. Thematic reviews and other informal tools create a patchwork of quasi-rules that firms are expected to know and follow, even though they lack the official status, consultation process, or scrutiny of formal regulations.
The worst of all worlds: PBR meets strict enforcement
The SRA’s current approach seems to combine the downsides of principles-based regulation (PBR) and overly zealous enforcement. Firms are told they have flexibility to comply with broad principles, but in practice, they are held to the minutiae of evolving guidance from a regulator that constantly moves the goalposts. Compliance officers are required to make declarations to the effect that their firm is entirely compliant, a blatant trap to ensure there is something else on which to hang future prosecutions.
The regulator’s readiness to issue eye-watering fines for historic breaches (where no harm occurred) compounds the issue, leaving many firms feeling like they are navigating a minefield without a map.
One of the biggest problems is that today’s enforcement decisions often punish yesterday’s conduct based on standards that were only clarified later through guidance or thematic reviews. This retrospective approach undermines confidence in the fairness of the regulatory system.
Codifying the quasi-rules?
We will reach a tipping point. The SRA’s various thematic reviews, warning notices, guidance notes, “risk outlooks”, discussion papers, press releases, YouTube sessions, and conference speeches now form a sprawling web of disparate quasi-rules and expectations that firms must interpret and apply. The sheer volume and variability of these materials make it impossible to know with certainty whether you’ve got the full picture—or if the goalposts will shift again tomorrow.
At some point, the legal profession will demand clarity. The quasi-rules will have to be brought together, possibly bringing us full circle back to something like a black-and-white rulebook—the very thing principles-based and outcomes-focused regulation were supposed to avoid. If the regulators can’t be trusted to make flexibility a realistic option for solicitors, they should go back to clearly setting out the rules in a clear, usable format. Some sort of codification could at least provide a clear, stable framework that firms could rely upon.
This is unlikely to happen. It would involve a recognition that the current system of regulation, which the SRA invested so much in championing, is not working. And that it is failing not because flexibility is a bad idea in itself, but because of its own approach to rule-making and enforcement. The SRA cannot even bring itself to acknowledge its faults when an independent report commissioned by its own supervisor brands the organisation as inadequate, ineffective and inefficient, so there is little hope of that.
A broken system
The current system leaves firms with little confidence that they fully understand their obligations. Even if you diligently consult the SRA’s formal rules and guidance, there’s no guarantee you’ve uncovered the entirety of the regulator’s expectations. How can firms operate with confidence when the “rules” are scattered across informal, non-binding documents that can be issued or updated without consultation?
This lack of transparency fundamentally undermines trust in the regulatory framework. It also creates a perverse effect: firms often overcompensate in their compliance efforts, investing unnecessary resources into being “seen” to be compliant rather than addressing actual risk, out of fear of falling foul of unclear expectations. Ticking boxes can seem like the safest thing to do, which is of course the opposite behaviour that PBR and the risk-based approach is intended to drive.
Where do we go from here?
The SRA needs to address the growing reliance on informal guidance as a de facto regulatory tool. Unless it does, we may soon find ourselves back where we started: with a rigid, black-and-white rulebook that sacrifices the promise of flexibility for the sake of clarity. And perhaps, after years of regulatory drift, that’s exactly what we need.
